b7ae0f7d14ce9a3423d5424845c5e70ca17d14b13631f21396248cad04027a35

General

Target

SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe
Size

1.1MB
MD5

7e30a93f146632fb1f17202b76297bc9
SHA1

178ca4abed0673ddb9a674d8f108c79f33099454
SHA256

b7ae0f7d14ce9a3423d5424845c5e70ca17d14b13631f21396248cad04027a35
SHA512

a2f865b4641dd48d4fa8fdf09e3b943b27047d585301e1bd9b246af12cb081a489b5f5e2735e77cab334dd627494a4bb9cf1081874a7b0bdb32b80d824a94c43

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exebdif.execmd.exe

description	pid	process	target process
PID 1376 wrote to memory of 1224	1376	SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe	bdif.exe
PID 1376 wrote to memory of 1224	1376	SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe	bdif.exe
PID 1376 wrote to memory of 1224	1376	SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe	bdif.exe
PID 1376 wrote to memory of 1224	1376	SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe	bdif.exe
PID 1224 wrote to memory of 1528	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 1528	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 1528	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 1528	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 1696	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1696	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1696	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1696	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1696	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1696	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1696	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1764	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 1764	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 1764	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 1764	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 1864	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1864	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1864	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1864	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1864	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1864	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 1864	1224	bdif.exe	rundll32.exe
PID 1224 wrote to memory of 2004	1224	bdif.exe	cmd.exe
PID 1224 wrote to memory of 2004	1224	bdif.exe	cmd.exe
PID 1224 wrote to memory of 2004	1224	bdif.exe	cmd.exe
PID 1224 wrote to memory of 2004	1224	bdif.exe	cmd.exe
PID 1224 wrote to memory of 2016	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 2016	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 2016	1224	bdif.exe	REG.exe
PID 1224 wrote to memory of 2016	1224	bdif.exe	REG.exe
PID 2004 wrote to memory of 988	2004	cmd.exe	schtasks.exe
PID 2004 wrote to memory of 988	2004	cmd.exe	schtasks.exe
PID 2004 wrote to memory of 988	2004	cmd.exe	schtasks.exe
PID 2004 wrote to memory of 988	2004	cmd.exe	schtasks.exe

Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

1224 bdif.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1696 rundll32.exe
1696 rundll32.exe
Blacklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

6 1696 rundll32.exe
10 1864 rundll32.exe
NTFS ADS 1 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe

description ioc process

File created \??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe

pid	process
1224	bdif.exe

pid	process
1696	rundll32.exe
1696	rundll32.exe

flow	pid	process
6	1696	rundll32.exe
10	1864	rundll32.exe

description	ioc	process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exeREG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

988 schtasks.exe

pid	process
988	schtasks.exe

Loads dropped DLL 10 IoCs

Processes:

SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exerundll32.exerundll32.exe

pid	process
1376	SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe
1376	SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe
1696	rundll32.exe
1696	rundll32.exe
1696	rundll32.exe
1696	rundll32.exe
1864	rundll32.exe
1864	rundll32.exe
1864	rundll32.exe
1864	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.43529991.18963.10385.exe"
1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
- Loads dropped DLL
PID:1376

\??\c:\programdata\1321ba6d1f\bdif.exe
c:\programdata\1321ba6d1f\bdif.exe
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1224

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
3⤵
- Adds Run key to start application
PID:1528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
3⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Loads dropped DLL
PID:1696

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
3⤵
- Adds Run key to start application
PID:1764

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
3⤵
- Blacklisted process makes network request
- Loads dropped DLL
PID:1864

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
4⤵
- Creates scheduled task(s)
PID:988

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
3⤵
PID:2016